Lets a log-out from someone who is already logged out through the host's CSRF check, instead of having it refused.
The log-out button submits the CSRF token of the session it was rendered
in. Once that session is gone — a double click, a second tab — the token
no longer matches, and the host's protect_from_forgery answers 403
Forbidden to an action that has in fact already succeeded. This plug
runs ahead of the :browser pipeline on the routes that carry log-out and
marks such a request as exempt (:plug_skip_csrf_protection, the switch
Plug.CSRFProtection reads). The request then takes the ordinary path:
the same pipelines, the same controller, the same flash and the same
locale-aware redirect as a first log-out.
It acts only when there is nothing to log out: no session token, no
account stack, and no remember-me cookie that could still sign the
visitor back in. Anything else is left untouched and meets the CSRF check
as before. The ordinary log-out still clears anonymous session data and
persisted account cookies. Hosts allowing cross-site session cookies
(SameSite=None) should account for that when exposing this exemption;
the default Lax cookies are not sent on a cross-site POST. The existing
GET /users/log-out route also logs out without a token.
Wired by PhoenixKitWeb.Integration; a host has nothing to add.